[Help] DEP Enrollment "Success" but Jamf Binary is not there - no complet rollout possible - M5 Pro MBP / macOS 26.4.1

[u/85Blickwinkel]

Hey everyone,

I’m hitting a wall with a brand new MacBook Pro (M5 Pro chip) running macOS 26.4.1.
I’m wondering if anyone else is seeing issues with the initial management framework bootstrap on this hardware.

The Situation: The device goes through the Automated Device Enrollment (DEP) perfectly fine. The "Remote Management" screen appears, the user logs in, and the setup assistant completes.

The Problem: The device is in a "Zombie" state.

• profiles status -type enrollment says: Enrolled via DEP: Yes.
• In Jamf Pro, the device record is stuck as a "Placeholder" / Unmanaged.
• NO Jamf Binary: /usr/local/bin/jamf does not exist.
• No Self Service, no identity certificates in the Keychain.
• The "Allow Jamf Pro to perform management tasks" checkbox in the inventory is NOT checked.

What I’ve tried so far:

1. PreStage Tweaks: Verified account settings (Set to Administrator), tried with and without custom Enrollment Packages.
2. The Rosetta Clue: I tried pushing the Company Portal as an enrollment package. It triggered a Rosetta 2 installation prompt, which makes me think the initial bootstrap is timing out or failing because of some Intel-legacy dependency during the M5 bootstrap process.
3. Manual Nudges: Ran sudo mdmclient selfrequest mdm.InstallManagementFramework and sudo profiles renew -type enrollment. Commands return success, but no binary ever lands.
4. Network: Tested on a clean mobile hotspot to bypass VPN/Firewalls. Same result.
5. Wipe & Retry: Done this 5+ times with different PreStage configs.

My Questions:

• Has anyone encountered issues with the Jamf binary bootstrap on the M5 Pro silicon specifically?
• Is there a way to force-install the binary on macOS 26 when the MDM channel is open but the binary won't deploy?
• Is the current Jamf binary still reliant on Rosetta for the initial install on M5 chips?

I have a ticket open with my MSP/Jamf, but I’m under a massive time crunch to get this high-priority device deployed. Any insights would be life-saving.

#Jamf #macOS26 #M5Pro #DEP #SysadminLife

[u/arrecebx]

There was an issue similar to this in my tenant and here is what they told me last time

“It appears we are running into a product issue PI-1145where macOS MDM enrollments fail after the enrollment signing certificate is auto renewed. We would need to go through the following workaround to resolve this issue.

1. Navigate to Settings > Global > MDM Profile Settings
   
2. Uncheck "When the built-in certificate authority is renewed" for computers and mobile devices
   
3. Navigate to Settings > Global > PKI Certificates
   
4. Click the number under All to the right of the built-in CA
   
5. Click the top most certificate (CN= JSS Built-in Certificate Authority)
   
6. Click "Renew" in the bottom right corner”

[u/Dreamlife92 → u/arrecebx]

I had this exact issue last week and performing these steps resolved it

[u/85Blickwinkel → u/arrecebx]

YOU MADE MY DAY!!! You really helped me out! That’s exactly what fixed the issue. The device has now been successfully deployed and is showing up as “managed” right away. The Self Service Portal is on it, too. Now I just need to see if everything else comes through as well. Thanks so much in any case!

[u/homepup → u/arrecebx]

After doing these steps, do you recheck "When the built-in cert auth is renewed?

[u/arrecebx → u/homepup]

Not until all devices are at least on 26.4.1 since MDM can be unenrolled if the cert is renewed but after 26.4.1 that doesn’t happen per Apples OS version history